[edk2-devel] [PATCH] SecurityPkg/AuthSeriableLib: Always delete variable in certdb
Zhang, Chao B
chao.b.zhang at intel.com
Mon May 13 14:09:50 UTC 2019
Reviewed-by : Chao Zhang <chao.b.zhang at intel.com>
-----Original Message-----
From: Gao, Zhichao
Sent: Monday, May 13, 2019 10:55 AM
To: devel at edk2.groups.io
Cc: Zhang, Chao B <chao.b.zhang at intel.com>; Yao, Jiewen <jiewen.yao at intel.com>; Wang, Jian J <jian.j.wang at intel.com>; Zeng, Star <star.zeng at intel.com>; Gao, Liming <liming.gao at intel.com>
Subject: [PATCH] SecurityPkg/AuthSeriableLib: Always delete variable in certdb
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=1783
While cleaning the certdb, always delete the variable data in the certdb regardless of its attribute.
Cc: Chao Zhang <chao.b.zhang at intel.com>
Cc: Jiewen Yao <jiewen.yao at intel.com>
Cc: Jian Wang <jian.j.wang at intel.com>
Cc: Star Zeng <star.zeng at intel.com>
Cc: Liming Gao <liming.gao at intel.com>
Signed-off-by: Zhichao Gao <zhichao.gao at intel.com>
---
SecurityPkg/Library/AuthVariableLib/AuthService.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPkg/Library/AuthVariableLib/AuthService.c
index 7493a2ed9c..2340d47e77 100644
--- a/SecurityPkg/Library/AuthVariableLib/AuthService.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c
@@ -1735,10 +1735,13 @@ CleanCertsFromDb (
);
if (EFI_ERROR(Status) || (AuthVariableInfo.Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
+ //
+ // While cleaning certdb, always delete the variable in certdb regardless of it attributes.
+ //
Status = DeleteCertsFromDb(
VariableName,
&AuthVarGuid,
- AuthVariableInfo.Attributes
+ AuthVariableInfo.Attributes |
+ EFI_VARIABLE_NON_VOLATILE
);
CertCleaned = TRUE;
DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));
--
2.21.0.windows.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#40510): https://edk2.groups.io/g/devel/message/40510
Mute This Topic: https://groups.io/mt/31603232/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list